SOLVED How to permanently use a snapshot (Recovery to a snapshot)

[Avi Poss]

Hi,
A computer on my network was infected with ransomware which encrypted all the files on my FreeNAS.
After cleaning all computers on the network, I cloned the last known good snapshots of all volumes and started running off these cloned drives in production.
How can I make this permanent?
Currently I have 2 volumes for every share, the original and the clone and then the shares point to the cloned versions.
Is there some way to mark the clones as production volumes and get rid of the old volumes?

Thanks!

 

[darkwarrior]

Hello there,

Look here in the documentation for what is commonly called a snapshot rollback ;)
And don't forget to educate users to avoid that kind of dangerous mishaps :p

 

[Avi Poss]

Hello there,

Look here in the documentation for what is commonly called a snapshot rollback ;)
And don't forget to educate users to avoid that kind of dangerous mishaps :p

Hi!
I saw that, but the cloned volume is already being used. Also, that's only good for the very last snapshot taken, correct? In this case, we had to go 5-10 snapshots back, so it wouldn't have helped.

Now that I'm currently in the situation where the cloned volume is being used in production, is there any way to define the clone as the actual volume and delete the original? Or do I need to have storage downtime while I manually mount the infected volumes, delete everything in them and copy all files from the mounted clone?

 

[Robert Trevellyan]

You can zfs promote a clone. Check the documentation for details: https://www.freebsd.org/cgi/man.cgi?query=zfs&sektion=8

 

[Avi Poss]

You can zfs promote a clone. Check the documentation for details: https://www.freebsd.org/cgi/man.cgi?query=zfs&sektion=8

This is exactly what I was looking for. Thanks!

 

[darkwarrior]

Glad to hear that this solved it :)